@@ -15,25 +15,31 @@ cached content fast and including support for :ref:`Edge Side Includes <edge-sid
15
15
Make Symfony Trust the Reverse Proxy
16
16
------------------------------------
17
17
18
- For ESI to work correctly and for the :ref: `X-FORWARDED <varnish-x-forwarded-headers >`
19
- headers to be used, you need to configure Varnish as a
20
- :doc: `trusted proxy </cookbook/request/load_balancer_reverse_proxy >`.
18
+ Varnish automatically forwards the IP as ``X-Forwarded-For `` and leaves the
19
+ ``X-Forwarded-Proto `` header in the request. If you do not configure Varnish as
20
+ trusted proxy, Symfony will see all requests as coming through insecure HTTP
21
+ connections from the Varnish host instead of the real client.
22
+
23
+ Remember to configure :ref: `framework.trusted_proxies <reference-framework-trusted-proxies >`
24
+ in the Symfony configuration so that Varnish is seen as a trusted proxy and the
25
+ :ref: `X-Forwarded <varnish-x-forwarded-headers >` headers are used.
21
26
22
27
.. _varnish-x-forwarded-headers :
23
28
24
29
Routing and X-FORWARDED Headers
25
30
-------------------------------
26
31
27
- To ensure that the Symfony Router generates URLs correctly with Varnish,
28
- a ``X-Forwarded-Port `` header must be present for Symfony to use the
29
- correct port number.
32
+ If the ``X-Forwarded-Port `` header is not set correctly, Symfony will append
33
+ the port where the PHP application is running when generating absolute URLs,
34
+ e.g. ``http://example.com:8080/my/path ``. To ensure that the Symfony router
35
+ generates URLs correctly with Varnish, add the correct port number in the
36
+ ``X-Forwarded-Port `` header. This port depends on your setup.
30
37
31
- This port depends on your setup. Lets say that external connections come in
32
- on the default HTTP port 80. For HTTPS connections, there is another proxy
33
- (as Varnish does not do HTTPS itself) on the default HTTPS port 443 that
34
- handles the SSL termination and forwards the requests as HTTP requests to
35
- Varnish with a ``X-Forwarded-Proto `` header. In this case, you need to add
36
- the following configuration snippet:
38
+ Suppose that external connections come in on the default HTTP port 80. For HTTPS
39
+ connections, there is another proxy (as Varnish does not do HTTPS itself) on the
40
+ default HTTPS port 443 that handles the SSL termination and forwards the requests
41
+ as HTTP requests to Varnish with a ``X-Forwarded-Proto `` header. In this case,
42
+ add the following to your Varnish configuration:
37
43
38
44
.. code-block :: varnish4
39
45
@@ -45,45 +51,30 @@ the following configuration snippet:
45
51
}
46
52
}
47
53
48
- .. note ::
49
-
50
- Remember to configure :ref: `framework.trusted_proxies <reference-framework-trusted-proxies >`
51
- in the Symfony configuration so that Varnish is seen as a trusted proxy
52
- and the ``X-Forwarded-* `` headers are used.
53
-
54
- Varnish automatically forwards the IP as ``X-Forwarded-For `` and leaves
55
- the ``X-Forwarded-Proto `` header in the request. If you do not configure
56
- Varnish as trusted proxy, Symfony will see all requests as coming through
57
- insecure HTTP connections from the Varnish host instead of the real client.
58
-
59
- If the ``X-Forwarded-Port `` header is not set correctly, Symfony will append
60
- the port where the PHP application is running when generating absolute URLs,
61
- e.g. ``http://example.com:8080/my/path ``.
62
-
63
54
Cookies and Caching
64
55
-------------------
65
56
66
57
By default, a sane caching proxy does not cache anything when a request is sent
67
- with :ref: `cookies or a basic authentication header<http-cache-introduction> `.
58
+ with :ref: `cookies or a basic authentication header <http-cache-introduction >`.
68
59
This is because the content of the page is supposed to depend on the cookie
69
60
value or authentication header.
70
61
71
62
If you know for sure that the backend never uses sessions or basic
72
- authentication, have varnish remove the corresponding header from requests to
63
+ authentication, have Varnish remove the corresponding header from requests to
73
64
prevent clients from bypassing the cache. In practice, you will need sessions
74
65
at least for some parts of the site, e.g. when using forms with
75
66
:ref: `CSRF Protection <forms-csrf >`. In this situation, make sure to
76
67
:doc: `only start a session when actually needed </cookbook/session/avoid_session_start >`
77
68
and clear the session when it is no longer needed. Alternatively, you can look
78
69
into :doc: `/cookbook/cache/form_csrf_caching `.
79
70
80
- Cookies created in Javascript and used only in the frontend, e.g. when using
81
- Google analytics are nonetheless sent to the server. These cookies are not
71
+ Cookies created in JavaScript and used only in the frontend, e.g. when using
72
+ Google Analytics, are nonetheless sent to the server. These cookies are not
82
73
relevant for the backend and should not affect the caching decision. Configure
83
74
your Varnish cache to `clean the cookies header `_. You want to keep the
84
75
session cookie, if there is one, and get rid of all other cookies so that pages
85
76
are cached if there is no active session. Unless you changed the default
86
- configuration of PHP, your session cookie has the name PHPSESSID:
77
+ configuration of PHP, your session cookie has the name `` PHPSESSID `` :
87
78
88
79
.. code-block :: varnish4
89
80
@@ -110,8 +101,8 @@ configuration of PHP, your session cookie has the name PHPSESSID:
110
101
implemented and explained by the FOSHttpCacheBundle _ under the name
111
102
`User Context `_.
112
103
113
- Ensure Consistent Caching Behaviour
114
- -----------------------------------
104
+ Ensure Consistent Caching Behavior
105
+ ----------------------------------
115
106
116
107
Varnish uses the cache headers sent by your application to determine how
117
108
to cache content. However, versions prior to Varnish 4 did not respect
@@ -143,7 +134,7 @@ using Varnish 3:
143
134
Enable Edge Side Includes (ESI)
144
135
-------------------------------
145
136
146
- As explained in the :ref: `Edge Side Includes section<edge-side-includes> `,
137
+ As explained in the :ref: `Edge Side Includes section <edge-side-includes >`,
147
138
Symfony detects whether it talks to a reverse proxy that understands ESI or
148
139
not. When you use the Symfony reverse proxy, you don't need to do anything.
149
140
But to make Varnish instead of Symfony resolve the ESI tags, you need some
@@ -168,10 +159,11 @@ application:
168
159
169
160
.. note ::
170
161
171
- The ``abc `` part of the header isn't important unless you have multiple "surrogates"
172
- that need to advertise their capabilities. See `Surrogate-Capability Header `_ for details.
162
+ The ``abc `` part of the header isn't important unless you have multiple
163
+ "surrogates" that need to advertise their capabilities. See
164
+ `Surrogate-Capability Header `_ for details.
173
165
174
- Then, optimize Varnish so that it only parses the Response contents when there
166
+ Then, optimize Varnish so that it only parses the response contents when there
175
167
is at least one ESI tag by checking the ``Surrogate-Control `` header that
176
168
Symfony adds automatically:
177
169
0 commit comments